I'm not at Ch 4 in @keydet89 new book but I highly recommend checking out pref.pl (prefetch parser) and rfc.pl (recentfilecache) #DFIR
2
@keydet89 @corey_harrell Seems like a lot of people use favorites as bookmarks-- "I want to look at this later"

Apr 16, 2014 · 1:20 AM UTC

1
Replying to @hal_pomeranz
@hal_pomeranz @keydet89 @corey_harrell That's how I normally use it. Makes it easy to find stuff again.